Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2026-24133

High
8.7/10

Summary

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.1.0, user control of the first argument of the "addImage" method results in Denial-of-Service (DoS). If given the possibility to pass unsanitized image data or URLs to the "addImage" method, a user can provide a harmful BMP file that results in out of memory errors and Denial-of-Service (DoS). Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The "html" method is also affected. The vulnerability has been fixed in [email protected].

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published